Malicious Code Vulnerability in mfaatest Package
Summary
MAL-2026-15629: Malicious code in mfaatest (npm). Affects mfaatest versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mfaatest package is an npm module designed for multi-factor authentication testing. It is intended to provide developers with tools to simulate and test various MFA scenarios. However, this package has been found to contain a critical vulnerability that allows the execution of arbitrary code from an untrusted source, posing significant security risks to users.
Vulnerability Detail
The vulnerability originates from the mfaatest package's dependency on node-net-pool, which is declared with an arbitrary HTTPS tarball URL instead of a version range from a trusted registry. During the npm install process, this allows the package to fetch and execute any code returned by the specified URL, which is controlled by an unrelated domain. This means that malicious actors can alter the content at the URL, leading to potential execution of harmful scripts on the user's system. The package's description falsely claims to have 'zero runtime dependencies', which contradicts the presence of this off-registry dependency, indicating a serious oversight in security practices.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall mfaatestIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can manually remove the dependency on node-net-pool from the package.json file and replace it with a secure alternative or a specific version from a trusted registry. This can be done by editing the package.json file to remove the line that specifies the dependency and then running npm install to update your package lock.
Conclusion
The mfaatest package contains a serious vulnerability that allows for the execution of malicious code from an untrusted source. It is essential for developers to be vigilant about the dependencies they include in their projects and to take immediate action to mitigate risks by updating or replacing vulnerable packages.
See every vulnerability recorded for mfaatest →
FAQ
The mfaatest package is used for testing multi-factor authentication scenarios in applications.
This vulnerability allows malicious code to be executed on your system, potentially compromising sensitive data and application integrity.
Check for updates to the mfaatest package using npm. If a patched version is available, it is recommended to update immediately.
You can use Vulert, which monitors your package-lock.json file to alert you in real-time for open-source vulnerabilities without needing to access the code.
As a temporary measure, consider removing the vulnerable dependency or replacing it with a secure alternative until you can update.
